Linker symbol differences (prvtkey_pem_end - prvtkey_pem_start) are not
compile-time constants and cannot be used in static initializers.
(cherry picked from commit 4196734d1a)
Add ESP_KEY_SOURCE_BUFFER and ESP_KEY_SOURCE_PSA key sources so all
hardware backends (DS, ECDSA, secure element) are accessed via PSA
key IDs through a single esp_tls_cfg_t.client_key field.
(cherry picked from commit 36090b7161)
Merge branch 'release/v6.0' into backport-48352-resolve to resolve a
conflict in esp_httpd_priv.h between this backport's sdkconfig.h
include and the ctrl-socket semaphore's freertos/semphr.h include.
fix(examples): make https_request rom_impl CI test resilient to transient external server failures (backport v6.0)
See merge request espressif/esp-idf!48418
Make it possible to disable http(s) server events. This improves
performance of the server, as http server creates events on every signle
read or write to the socket.
The rom_impl variant of the https_request example test connects to an
external server, which requires a valid system time for TLS certificate
validation. In CI, SNTP time sync can be unreachable, causing transient
failures. Write the host timestamp into the DUT's NVS partition (via the
existing write_time_to_nvs helper) before running the test, so the
firmware can set its clock without depending on external NTP servers.
Replace erase_nvs + SNTP time sync with direct NVS timestamp injection
from the pytest host. This eliminates CI flakiness caused by NTP servers
being unreachable from the CI lab network.
Changes:
- Add write_time_to_nvs() helper that generates an NVS partition image
with the current host timestamp and flashes it to the DUT before each
test. The firmware reads this via the existing update_time_from_nvs()
path and skips SNTP entirely.
- Remove @pytest.mark.parametrize('erase_nvs', ['y']) from all 4
Ethernet-based tests since NVS is now written with valid data.
Replace howsmyssl.com with letsencrypt.org in the https_x509_bundle
example. howsmyssl.com is a third-party server that is frequently
unreachable from CI, causing flaky test failures. letsencrypt.org
chains to the same ISRG Root X1 CA, so the custom certificate bundle
validation coverage is identical.
Since letsencrypt.org was already present in the full bundle URL list,
remove the duplicate entry and reduce MAX_URLS from 9 to 8. All 6
unique root CAs in the stress test are still covered.
For the QEMU stress test, increase per-connection timeout from 30s to
60s and final completion timeout from 60s to 180s. QEMU emulated
network is 3-5x slower than real hardware for TLS handshakes.
(cherry picked from commit d6596eff3a)
(squashed with commit 995c0f129e)
The WebSocket echo server tests connect immediately after seeing
'Starting server on port:' in the device log, but URI handlers
(/ws, /auth) are registered asynchronously after the server starts,
taking 40-660ms depending on config and CI load.
This causes two failures:
1. WebSocket handshake returns 404 Not Found because the URI
handler is not registered yet when the client connects.
2. WebSocket echo returns wrong data because the server is in a
partially initialized state.
Wait for 'Returned from app_main()' before connecting, which
guarantees all URI handlers are registered. Add connection retry
with WebSocketBadStatusException handling to WsClient.
Extract _wait_for_server_ready() helper to deduplicate the WiFi
credential input and server readiness logic.
(cherry picked from commit 7a50e3ab04)
The async handler CI tests fail intermittently because the TCP
connection from the pytest host to the ESP32 HTTP server times out
or gets refused.
Add a _connect_with_retry() helper that retries the TCP connection
up to 3 times with a 2-second delay between attempts, catching
TimeoutError, ConnectionRefusedError, and OSError.
Extract common server startup waiting into _wait_for_server_ready()
which includes a 2-second stabilization delay after the server
registers its URI handlers before tests begin sending requests.
(cherry picked from commit a665e7410c)
